CVE-2026-109828
libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 13, 2026
- Updated
- Oct 13, 2026
- Reserved
- Oct 13, 2026
Description
A vulnerability was found in libsndfile up to 1.2.2. This issue affects the function wavlike_subchunk_parse of the file src/wavlike.c of the component WAV Parsing. Performing a manipulation results in use of uninitialized variable. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
libsndfilen/a |
|
References
- VDB-417466 | libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variablevdb-entrytechnical-description
- VDB-417466 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-109828 | CVE Analysis and Reportthird-party-advisory
- Submit #1002209 | libsndfile b9103bd48b6c8fb517ae737fe3baee0c718b804c Use of Uninitialized Resourcethird-party-advisory
- https://github.com/libsndfile/libsndfile/issues/1169exploitissue-tracking
- https://github.com/libsndfile/libsndfile/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.